Hyperbridge discloses details of the attack incident, vulnerability stems from flaw in Merkle proof verification logic

Techub News reports that blockchain interoperability protocol Hyperbridge has issued an update regarding the previous DOT attack incident, confirming losses of approximately $237,000. The root cause of the vulnerability lies in the lack of necessary input validation in the VerifyProof() function of the HandlerV1 contract. Due to the absence of verification for leaf_index < leafCount, attackers were able to forge Merkle proofs and obtain administrator privileges for the bridged DOT token contract on Ethereum. The attacker subsequently illegally minted 1 billion bridged DOT tokens (approximately 2800 times the legitimate circulating supply) and cashed out on DEXs. Hyperbridge stated that it is currently working with security partners to trace the flow of funds, and cross-chain functionality will remain suspended until the investigation is complete.